BTCPay Server

This commit simply turns down the volume on log messages coming from BTCPayServer's security components. It changes the logging level from the default (likely Information/Debug) to Warning, so routine 'authentication scheme challenged' messages no longer fill the logs. There is no code behavior change, no bug fix, and no security vulnerability being patched.

This commit only changes a test file to make an automated test less flaky. It adds checks so the test waits for the correct payout event and allows empty hooks in one specific scenario. There is no change to production code and no security issue.

This commit strengthens BTCPay Server's defenses against cross-site request forgery (CSRF) attacks. Instead of manually adding CSRF protection to each web UI controller, the team added a single global filter that automatically checks CSRF tokens for all UI controllers. They also converted several API (Greenfield) controllers from the web-style Controller base class to the API-style ControllerBase so the global filter does not accidentally apply CSRF checks to API endpoints. A few endpoints that legitimately need to skip CSRF (such as the error page and invoice state changes) are explicitly marked to ignore it. The change is a security hardening patch, but the commit message and diff alone do not prove a specific exploitable vulnerability existed before.

This commit updates BTCPay Server's automated test environment to use Bitcoin Core version 30.2 instead of 29.1. It also adjusts a few test helper calls and one test assertion to match changed behavior in the newer Bitcoin Core version. There is no direct evidence in the commit of a security vulnerability being fixed or introduced.

This commit is a large code refactor that moves BTCPay Server's Bitpay-compatible API from the core application into a separate plugin. It relocates controllers, authentication, models, views, and middleware into a new Plugins/Bitpay folder, updates tests and dependency injection, and replaces the old middleware-based Bitpay API detection with a new endpoint selector policy. The change itself is structural rather than a targeted security fix, but any large refactor of authentication and routing code carries a risk of accidentally changing access-control behavior.

This commit is a routine code reorganization: it moves BTCPay Server's translation/localization code from the core server project into a dedicated 'Translations' plugin. The same dictionary-management features, language-pack download, and localization services are preserved, just relocated. There is no indication of a security fix or vulnerability being addressed.

This commit fixes a JavaScript crash in the subscription portal. When a user had a lifetime subscription, the page did not show an auto-renewal checkbox, but the script still tried to attach an event listener to it. That caused a browser error that blocked the rest of the page's JavaScript, making it impossible to upgrade or downgrade the subscription. The fix simply checks whether the checkbox exists before attaching the listener. There is no direct security vulnerability here; it is a functional bug with a minor denial-of-service-like effect on the UI.

This commit only changes a test file. It adds one extra assertion and reorders two existing assertions. There is no change to production code, no security fix, and no vulnerability.

This commit only changes a single version number in a build file from 2.3.5 to 2.3.6. There is no code change, no bug fix, and no security-related content.

This commit cleans up leftover build configuration entries in two C# project files. It removes duplicate or stale entries that told the build system how to treat certain view files and folders. There is no indication this change fixes or introduces a security problem; it appears to be routine housekeeping.

This commit removes a feature called 'Razor runtime compilation' from the main BTCPay Server application. Previously, in debug/development builds, the server could recompile web page templates (Razor views) on the fly while running. The change makes the server always use pre-compiled views instead. Runtime compilation is useful for developers but can increase attack surface, so removing it from production-like builds is a hardening move. A special test-only flag is added so developers can still enable it for testing.

This commit upgrades BTCPay Server from .NET 8 to .NET 10 and bumps many third-party libraries. It also makes small code changes to adapt to new framework APIs. The update itself is a routine maintenance change, but it removes some older dependencies and includes a few minor hardening tweaks, such as adding a null check before processing payment requests and filtering swagger files by extension. There is no direct evidence in the commit that this fixes a known security vulnerability, and the commit message does not mention security.

This commit changes a single line of on-screen help text in BTCPay Server. It updates the instructions for Wasabi wallet users, telling them to search for 'wallet folder' instead of using an older menu path. There is no code behavior change, no security fix, and no vulnerability.

This commit updates a single test file so that a language-pack test reads the list of downloadable languages from a shared service class instead of parsing a Razor view file directly. It is a test maintenance/refactoring change with no visible security relevance.

This commit fixes a flaky automated UI test by making the test wait until a notifications component has finished rendering before checking its contents. The code change adds a 'rendered' CSS class once Blazor has finished pre-rendering and updates the test to look for that class. There is no security relevance.

This commit is a routine version bump from 2.3.4 to 2.3.5 and updates the changelog. It does not change any application code, configuration, or security settings. There is nothing in the diff that introduces, fixes, or alters a security-relevant behavior.